diff --git a/api/static-site.ts b/api/static-site.ts
index 5873f46..ea00d6b 100644
--- a/api/static-site.ts
+++ b/api/static-site.ts
@@ -235,7 +235,18 @@ const NGINX_CONF = `server {
     add_header Cache-Control "public";
   }
 
-  location ~* \\.(css|js|woff2|webp|png|jpg|jpeg|gif|svg|ico|mp4)$ {
+  # The typefaces. A year, because a face is not edited — it is replaced, and a replacement is a new
+  # name. This is the one directory here where a long life carries no risk of pinning something stale.
+  location ^~ /fonts/ {
+    expires 1y;
+    add_header Cache-Control "public, immutable";
+  }
+
+  # Everything a build produces. Seven days and no more: these names are stable across builds and the
+  # HTML that references them is revalidated every time, so a longer life means a visitor running last
+  # week's stylesheet against this week's markup. Fingerprinted filenames are what would earn a year
+  # here, and the build does not write them.
+  location ~* \\.(css|js|webp|png|jpg|jpeg|gif|svg|ico|mp4)$ {
     expires 7d;
     add_header Cache-Control "public";
   }